opencode-matrixx 2.6.1 → 2.6.3

package/README.md

@@ -1,8 +1,6 @@
 >
 > [![Matrixx](./.github/assets/orchestrator-architect.png?v=3)](https://github.com/klpanagi/opencode-matrixx)
 >
-> Matrixx is **highly inspired by** [oh-my-opencode](https://github.com/code-yeongyu/oh-my-opencode) — the project that pioneered the "oh-my-zsh for OpenCode" concept.
-> Full credit to [code-yeongyu](https://github.com/code-yeongyu) for the original vision.
 >
 
 <div align="center">
@@ -13,7 +11,7 @@
 [![License: SUL-1.0](https://img.shields.io/badge/license-SUL--1.0-blue.svg)](https://github.com/klpanagi/opencode-matrixx/blob/master/LICENSE)
 
 **Multi-model agent orchestration for [OpenCode](https://github.com/sst/opencode).**<br/>
-**14 specialized agents. ~52 lifecycle hooks. 28 tools. One plugin.**
+**14 specialized agents. 64 lifecycle hooks. 22 tools. 36 skills. One plugin.**
 
 </div>
 
@@ -43,7 +41,7 @@ Morpheus (Claude Opus)     → Plans the implementation
 | Problem | Matrixx Solution |
 |---------|------------------|
 | One model does everything poorly | **14 specialists** — right model for the right job |
-| Agent forgets what it was doing | **Todo Continuation** — forces completion, no exceptions |
+| Agent forgets what it was doing | **Task Continuation** — `task-continuation-enforcer` (file-backed `.matrixx/tasks`, survives `/clear`, project-scoped) — forces completion |
 | Slow sequential tool calls | **Parallel background agents** — 5+ running simultaneously |
 | AI-generated code looks like AI | **Comment Checker** — code indistinguishable from human-written |
 | Context window fills up fast | **Aggressive delegation** — subagents carry the load |
@@ -160,7 +158,7 @@ Use `--json` for machine-readable output or `--category <name>` for a specific c
 
 **Model:** Claude Opus 4.6 · `temperature: 0.1`
 
-Plans, delegates, and executes. Fires background agents in parallel, leverages LSP and AST-Grep for surgical refactoring, and never stops until the TODO list is empty. Morpheus sees the code for what it truly is — and routes every task to the agent best suited for it.
+Plans, delegates, and executes. Fires background agents in parallel, leverages LSP and AST-Grep for surgical refactoring, and never stops until the task list is empty. Morpheus sees the code for what it truly is — and routes every task to the agent best suited for it.
 
 ---
 
@@ -355,10 +353,10 @@ Every agent, model, temperature, and permission is fully customizable. [**Meet t
 
 | | |
 |---|---|
-| **Agent Orchestration** | 15 agents (incl. **Mouse** dedicated executor, **Sati** frontend specialist, **Sentinel** security auditor, **Cipher** DSL expert), parallel background execution, category-based routing, session continuity |
+| **Agent Orchestration** | 14 agents (incl. **Mouse** task executor, **Sati** frontend specialist, **Sentinel** security auditor, **Cipher** DSL expert), parallel background execution, category-based routing (`source`/`deep-jack`/…), session continuity, file-backed tasks |
 | **Developer Tools** | LSP (goto def, rename, diagnostics), AST-Grep (search & replace), Tmux terminal |
-| **~52 Lifecycle Hooks** | Context injection, think mode, comment checking, todo enforcement, error recovery, quality gate |
-|| **33 Built-in Skills** | DSL engineering (11), security (9), browser, git, frontend (7 via **Sati**), saturation research, AI slop detection, software dev pipeline |
+| **64 Lifecycle Hooks** | Context injection, think mode, comment checking, task/todo continuation enforcement, error recovery, quality gate, preemptive compaction, session recovery |
+| **36 Built-in Skills** | DSL engineering (11), security (9), browser, git, frontend (7 via **Sati**), BDD (4: `bdd-contract`/`backend`/`frontend`/`tests` + pipeline), saturation research, AI slop detection, TDD (`tdd-enforcer` opt-in), software dev pipeline |
 | **Curated MCPs** | Exa (web search), Context7 (official docs), Grep.app (GitHub code search), Document Reader |
 | **Claude Code Compat** | Full compatibility — commands, agents, skills, MCPs, hooks from `settings.json` |
 | **Software Dev Pipeline** | 6-phase TDD workflow (PLAN→BUILD→VERIFY→REVIEW→SECURE→SHIP), 5 team roles, adaptive phases |
@@ -379,9 +377,9 @@ Matrixx includes a structured **6-phase development pipeline** that coordinates
 
 | Role | Agent | Skills | Purpose |
 |------|-------|--------|---------|
-| **Architect** | Oracle (Claude Opus) | — | System design, architecture decisions, task breakdown |
-| **Developer** | Source category | `git-master`, `tdd-enforcer` | Implementation code with TDD |
-| **Tester** | Source category | `tdd-enforcer`, `quality-gate` | Test authoring, coverage, verification |
+| **Architect** | Oracle (`claude-sonnet-4-6`) | — | System design, architecture decisions, plan (`/.matrixx/plans/*.md`) breakdown |
+| **Developer** | `category="source"` (Mouse) | `git-master`, `tdd-enforcer` (opt-in `tdd_enforcer.enabled=true`) | Implementation — RED→GREEN→REFACTOR per task |
+| **Tester** | `category="source"` (Mouse) | `tdd-enforcer`, `quality-gate` | Test authoring (`src/**/*.test.ts`, `//#given//#when//#then`), coverage |
 | **Quality Evaluator** | Red-pill category | `quality-gate`, `review-work` | Lint, typecheck, 5-agent code review |
 | **Security Expert** | Sentinel (Claude Opus) | `security-core`, `security-sast`, `security-api`, `security-dependencies` | Vulnerability scanning, CVE checks |
 
@@ -389,7 +387,7 @@ Matrixx includes a structured **6-phase development pipeline** that coordinates
 
 | Phase | Skip? | Role | Exit Criteria |
 |-------|-------|------|---------------|
-| **PLAN** | Small tasks | Architect | Approach defined, files listed, edge cases documented |
+| **PLAN** | Small tasks | Architect (Oracle) | Approach defined, files listed, edge cases + test decision (`TDD/tests-after/none`) documented |
 | **BUILD** | Never | Developer | TDD (RED→GREEN→REFACTOR), `bun test` passes |
 | **VERIFY** | Never | Quality | `lint` + `typecheck` + `test` + `build` — all pass |
 | **REVIEW** | Small tasks | Quality (5-agent) | All reviewers PASS, no CRITICAL/MAJOR issues |
@@ -665,6 +663,8 @@ To disable, set `headroom.enabled: false` or run OpenCode without `headroom wrap
 | [Orchestration](docs/orchestration-guide.md) | How agents coordinate, delegate, and recover |
 | [Categories & Skills](docs/category-skill-guide.md) | Task categories, skill injection, delegation patterns |
 | [Context Management](docs/context-management.md) | 5-layer context stack (Native, RTK, context-mode, DCP, Headroom) — setup, config, verification |
+| [Task System](docs/task-system.md) | File-backed execution substrate (`.matrixx/tasks/T-{uuid}.json`), dependency graph, `task-continuation-enforcer` |
+| [TDD](docs/tdd.md) | RED→GREEN→REFACTOR planning (Oracle) + enforcement (`tdd-enforcer` opt-in) |
 
 ---
 

package/dist/cli.js

@@ -15868,6 +15868,13 @@ var CommentCheckerConfigSchema = exports_external.object({
   custom_prompt: exports_external.string().optional()
 });
 
+// src/config/schema/context-mode.ts
+var ContextModeConfigSchema = exports_external.object({
+  enabled: exports_external.boolean().default(true),
+  enforce: exports_external.boolean().default(false),
+  blocked_tools: exports_external.array(exports_external.string()).default(["read", "grep", "glob"])
+});
+
 // src/config/schema/dcp.ts
 var DcpCompressOverrideSchema = exports_external.object({
   maxContextLimit: exports_external.union([exports_external.number(), exports_external.string().regex(/^\d+%$/)]).optional(),
@@ -16114,6 +16121,8 @@ var ExperimentalConfigSchema = exports_external.object({
   truncate_all_tool_outputs: exports_external.boolean().optional(),
   task_system: exports_external.boolean().optional().default(true),
   plugin_load_timeout_ms: exports_external.number().min(1000).optional(),
+  context_warning_threshold: exports_external.number().min(0.1).max(0.95).optional(),
+  preemptive_compaction_threshold: exports_external.number().min(0.1).max(0.95).optional(),
   safe_hook_creation: exports_external.boolean().optional(),
   hashline_edit: exports_external.boolean().optional()
 });
@@ -16127,21 +16136,18 @@ var HeadroomConfigSchema = exports_external.object({
 });
 
 // src/config/schema/hooks.ts
-var HookNameSchema = exports_external.enum([
+var HookNameEnum = exports_external.enum([
   "task-continuation-enforcer",
   "todo-continuation-enforcer",
   "context-window-monitor",
   "session-recovery",
   "session-notification",
   "comment-checker",
-  "grep-output-truncator",
   "tool-output-truncator",
-  "question-label-truncator",
   "directory-agents-injector",
-  "directory-readme-injector",
   "empty-task-response-detector",
   "think-mode",
-  "anthropic-context-window-limit-recovery",
+  "context-window-limit-recovery",
   "preemptive-compaction",
   "rules-injector",
   "background-notification",
@@ -16172,6 +16178,7 @@ var HookNameSchema = exports_external.enum([
   "anthropic-effort",
   "hashline-read-enhancer",
   "secret-leak-guard",
+  "input-secret-guard",
   "env-context-injector",
   "env-file-write-guard",
   "json-error-recovery",
@@ -16185,13 +16192,16 @@ var HookNameSchema = exports_external.enum([
   "task-notepad",
   "design-intent-preserver",
   "rtk-bash-rewriter",
-  "mcp-startup-notification",
   "evolution-watcher",
   "evolution-compressor",
-  "evolution-quality-gate",
   "evolution-hitl",
+  "context-mode-enforcer",
   "task-edit-guard"
 ]);
+var HookNameSchema = exports_external.union([
+  HookNameEnum,
+  exports_external.literal("anthropic-context-window-limit-recovery").transform(() => "context-window-limit-recovery")
+]);
 
 // src/config/schema/matrix-loop.ts
 var MatrixLoopConfigSchema = exports_external.object({
@@ -16210,7 +16220,6 @@ var MatrixxSelfConfigSkillConfigSchema = exports_external.object({
 var MorpheusTasksConfigSchema = exports_external.object({
   storage_path: exports_external.string().optional(),
   task_list_id: exports_external.string().optional(),
-  claude_code_compat: exports_external.boolean().default(false),
   scope: exports_external.enum(["global", "project"]).default("project").optional().describe("Task storage scope: project \u2192 .matrixx/tasks per project (default), global \u2192 ~/.config/opencode/tasks/{listId}")
 });
 var MorpheusConfigSchema = exports_external.object({
@@ -16279,10 +16288,23 @@ var DependencyAuditConfigSchema = exports_external.object({
   enabled: exports_external.boolean().default(false),
   on_package_change: exports_external.boolean().default(true)
 });
+var InputSecretGuardModeSchema = exports_external.enum(["prompt", "block", "off"]);
+var InputSecretGuardConfigSchema = exports_external.object({
+  enabled: exports_external.boolean().default(true),
+  mode: InputSecretGuardModeSchema.default("prompt"),
+  blocklist_mode: exports_external.enum(["prompt", "block"]).default("prompt"),
+  warnlist_mode: exports_external.enum(["prompt", "off"]).default("prompt"),
+  allowlist_patterns: exports_external.array(exports_external.string()).optional(),
+  detection: exports_external.object({
+    entropy_threshold: exports_external.number().min(0).max(8).default(4.5),
+    max_scan_bytes: exports_external.number().int().min(1024).max(256 * 1024).default(64 * 1024)
+  }).optional()
+});
 var SecurityConfigSchema = exports_external.object({
   secret_scanning: SecretScanningConfigSchema.optional(),
   env_file_guard: EnvFileGuardConfigSchema.optional(),
-  dependency_audit: DependencyAuditConfigSchema.optional()
+  dependency_audit: DependencyAuditConfigSchema.optional(),
+  input_secret_guard: InputSecretGuardConfigSchema.optional()
 });
 
 // src/config/schema/skills.ts
@@ -16381,6 +16403,7 @@ var MatrixxConfigSchema = exports_external.object({
   agent_definitions: AgentDefinitionsConfigSchema.optional(),
   matrixx_self_config: MatrixxSelfConfigSkillConfigSchema.optional(),
   headroom: HeadroomConfigSchema.optional(),
+  context_mode: ContextModeConfigSchema.optional(),
   rtk: RtkConfigSchema.optional(),
   evolution: EvolutionConfigSchema.optional(),
   _migrations: exports_external.array(exports_external.string()).optional()
@@ -16461,6 +16484,27 @@ var configValidationCheck = {
 // src/cli/doctor/checks/context-mode.ts
 import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
 import { join as join7 } from "path";
+function loadContextModeConfig() {
+  const dir = getOpenCodeConfigDir({ binary: "opencode" });
+  const bases = [join7(dir, "matrixx"), join7(process.cwd(), ".opencode", "matrixx"), join7(process.cwd(), "matrixx")];
+  for (const base of bases) {
+    for (const ext of [".jsonc", ".json"]) {
+      const p = `${base}${ext}`;
+      if (!existsSync6(p))
+        continue;
+      try {
+        const c = readFileSync5(p, "utf-8");
+        const parsed = parseJsoncSafe(c);
+        if (!parsed.data || parsed.errors.length > 0)
+          continue;
+        const cm = parsed.data.context_mode;
+        if (cm && typeof cm.enabled === "boolean")
+          return { enabled: cm.enabled };
+      } catch {}
+    }
+  }
+  return null;
+}
 function hasContextModePlugin() {
   const dir = getOpenCodeConfigDir({ binary: "opencode" });
   for (const name of ["opencode.jsonc", "opencode.json"]) {
@@ -16489,6 +16533,15 @@ var contextModeCheck = {
   name: "context-mode-integration",
   category: "integrations",
   check: () => {
+    const cfg = loadContextModeConfig();
+    if (cfg && !cfg.enabled) {
+      return {
+        name: "context-mode-integration",
+        status: "pass",
+        message: "context-mode disabled via matrixx.jsonc \u2014 skipping",
+        detail: "Set context_mode.enabled:true in matrixx.jsonc to enable discipline and enforcer"
+      };
+    }
     const hasPlugin = hasContextModePlugin();
     const cacheDir = getOmoOpenCodeCacheDir();
     const hasCache = existsSync6(cacheDir);
@@ -18779,7 +18832,7 @@ Run with --yes to overwrite without prompt.`;
   const lines = [
     "",
     "\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510",
-    "\u2502  Matrixx Setup Complete" + dry.padEnd(12) + "\u2502",
+    `\u2502  Matrixx Setup Complete${dry.padEnd(12)}\u2502`,
     "\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518",
     "",
     report,

package/dist/config/schema/context-mode.d.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+export declare const ContextModeConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    enforce: z.ZodDefault<z.ZodBoolean>;
+    blocked_tools: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type ContextModeConfig = z.infer<typeof ContextModeConfigSchema>;

package/dist/config/schema/experimental.d.ts

@@ -6,6 +6,8 @@ export declare const ExperimentalConfigSchema: z.ZodObject<{
     truncate_all_tool_outputs: z.ZodOptional<z.ZodBoolean>;
     task_system: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     plugin_load_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    context_warning_threshold: z.ZodOptional<z.ZodNumber>;
+    preemptive_compaction_threshold: z.ZodOptional<z.ZodNumber>;
     safe_hook_creation: z.ZodOptional<z.ZodBoolean>;
     hashline_edit: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;

package/dist/config/schema/headroom.d.ts

@@ -12,7 +12,7 @@ import { z } from "zod";
  *   so the proxy sits transparently in front of the transport.
  * - Native transport integration is deferred until the compaction hook
  *   stabilizes (Headroom #76 collision risk with
- *   anthropic-context-window-limit-recovery).
+ *   context-window-limit-recovery).
  */
 export declare const HeadroomConfigSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;

package/dist/config/schema/hooks.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export declare const HookNameSchema: z.ZodEnum<{
+export declare const HookNameSchema: z.ZodUnion<readonly [z.ZodEnum<{
     architect: "architect";
     "quality-gate": "quality-gate";
     "matrix-loop": "matrix-loop";
@@ -12,14 +12,11 @@ export declare const HookNameSchema: z.ZodEnum<{
     "session-recovery": "session-recovery";
     "session-notification": "session-notification";
     "comment-checker": "comment-checker";
-    "grep-output-truncator": "grep-output-truncator";
     "tool-output-truncator": "tool-output-truncator";
-    "question-label-truncator": "question-label-truncator";
     "directory-agents-injector": "directory-agents-injector";
-    "directory-readme-injector": "directory-readme-injector";
     "empty-task-response-detector": "empty-task-response-detector";
     "think-mode": "think-mode";
-    "anthropic-context-window-limit-recovery": "anthropic-context-window-limit-recovery";
+    "context-window-limit-recovery": "context-window-limit-recovery";
     "preemptive-compaction": "preemptive-compaction";
     "rules-injector": "rules-injector";
     "background-notification": "background-notification";
@@ -47,6 +44,7 @@ export declare const HookNameSchema: z.ZodEnum<{
     "anthropic-effort": "anthropic-effort";
     "hashline-read-enhancer": "hashline-read-enhancer";
     "secret-leak-guard": "secret-leak-guard";
+    "input-secret-guard": "input-secret-guard";
     "env-context-injector": "env-context-injector";
     "env-file-write-guard": "env-file-write-guard";
     "json-error-recovery": "json-error-recovery";
@@ -59,9 +57,8 @@ export declare const HookNameSchema: z.ZodEnum<{
     "task-notepad": "task-notepad";
     "design-intent-preserver": "design-intent-preserver";
     "rtk-bash-rewriter": "rtk-bash-rewriter";
-    "mcp-startup-notification": "mcp-startup-notification";
-    "evolution-quality-gate": "evolution-quality-gate";
     "evolution-hitl": "evolution-hitl";
+    "context-mode-enforcer": "context-mode-enforcer";
     "task-edit-guard": "task-edit-guard";
-}>;
+}>, z.ZodPipe<z.ZodLiteral<"anthropic-context-window-limit-recovery">, z.ZodTransform<"context-window-limit-recovery", "anthropic-context-window-limit-recovery">>]>;
 export type HookName = z.infer<typeof HookNameSchema>;

package/dist/config/schema/matrixx-config.d.ts

@@ -67,7 +67,7 @@ export declare const MatrixxConfigSchema: z.ZodObject<{
         "bdd-frontend": "bdd-frontend";
         "bdd-tests": "bdd-tests";
     }>>>;
-    disabled_hooks: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+    disabled_hooks: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<{
         architect: "architect";
         "quality-gate": "quality-gate";
         "matrix-loop": "matrix-loop";
@@ -80,14 +80,11 @@ export declare const MatrixxConfigSchema: z.ZodObject<{
         "session-recovery": "session-recovery";
         "session-notification": "session-notification";
         "comment-checker": "comment-checker";
-        "grep-output-truncator": "grep-output-truncator";
         "tool-output-truncator": "tool-output-truncator";
-        "question-label-truncator": "question-label-truncator";
         "directory-agents-injector": "directory-agents-injector";
-        "directory-readme-injector": "directory-readme-injector";
         "empty-task-response-detector": "empty-task-response-detector";
         "think-mode": "think-mode";
-        "anthropic-context-window-limit-recovery": "anthropic-context-window-limit-recovery";
+        "context-window-limit-recovery": "context-window-limit-recovery";
         "preemptive-compaction": "preemptive-compaction";
         "rules-injector": "rules-injector";
         "background-notification": "background-notification";
@@ -115,6 +112,7 @@ export declare const MatrixxConfigSchema: z.ZodObject<{
         "anthropic-effort": "anthropic-effort";
         "hashline-read-enhancer": "hashline-read-enhancer";
         "secret-leak-guard": "secret-leak-guard";
+        "input-secret-guard": "input-secret-guard";
         "env-context-injector": "env-context-injector";
         "env-file-write-guard": "env-file-write-guard";
         "json-error-recovery": "json-error-recovery";
@@ -127,11 +125,10 @@ export declare const MatrixxConfigSchema: z.ZodObject<{
         "task-notepad": "task-notepad";
         "design-intent-preserver": "design-intent-preserver";
         "rtk-bash-rewriter": "rtk-bash-rewriter";
-        "mcp-startup-notification": "mcp-startup-notification";
-        "evolution-quality-gate": "evolution-quality-gate";
         "evolution-hitl": "evolution-hitl";
+        "context-mode-enforcer": "context-mode-enforcer";
         "task-edit-guard": "task-edit-guard";
-    }>>>;
+    }>, z.ZodPipe<z.ZodLiteral<"anthropic-context-window-limit-recovery">, z.ZodTransform<"context-window-limit-recovery", "anthropic-context-window-limit-recovery">>]>>>;
     disabled_commands: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         "bdd-contract": "bdd-contract";
         "bdd-backend": "bdd-backend";
@@ -1690,6 +1687,8 @@ export declare const MatrixxConfigSchema: z.ZodObject<{
         truncate_all_tool_outputs: z.ZodOptional<z.ZodBoolean>;
         task_system: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         plugin_load_timeout_ms: z.ZodOptional<z.ZodNumber>;
+        context_warning_threshold: z.ZodOptional<z.ZodNumber>;
+        preemptive_compaction_threshold: z.ZodOptional<z.ZodNumber>;
         safe_hook_creation: z.ZodOptional<z.ZodBoolean>;
         hashline_edit: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
@@ -1857,7 +1856,6 @@ export declare const MatrixxConfigSchema: z.ZodObject<{
         tasks: z.ZodOptional<z.ZodObject<{
             storage_path: z.ZodOptional<z.ZodString>;
             task_list_id: z.ZodOptional<z.ZodString>;
-            claude_code_compat: z.ZodDefault<z.ZodBoolean>;
             scope: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
                 project: "project";
                 global: "global";
@@ -1892,6 +1890,27 @@ export declare const MatrixxConfigSchema: z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
             on_package_change: z.ZodDefault<z.ZodBoolean>;
         }, z.core.$strip>>;
+        input_secret_guard: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            mode: z.ZodDefault<z.ZodEnum<{
+                prompt: "prompt";
+                off: "off";
+                block: "block";
+            }>>;
+            blocklist_mode: z.ZodDefault<z.ZodEnum<{
+                prompt: "prompt";
+                block: "block";
+            }>>;
+            warnlist_mode: z.ZodDefault<z.ZodEnum<{
+                prompt: "prompt";
+                off: "off";
+            }>>;
+            allowlist_patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            detection: z.ZodOptional<z.ZodObject<{
+                entropy_threshold: z.ZodDefault<z.ZodNumber>;
+                max_scan_bytes: z.ZodDefault<z.ZodNumber>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     runtime_fallback: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -1912,6 +1931,11 @@ export declare const MatrixxConfigSchema: z.ZodObject<{
         project: z.ZodOptional<z.ZodString>;
         backend: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
+    context_mode: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        enforce: z.ZodDefault<z.ZodBoolean>;
+        blocked_tools: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
     rtk: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         binary_path: z.ZodOptional<z.ZodString>;

package/dist/config/schema/morpheus.d.ts

@@ -2,7 +2,6 @@ import { z } from "zod";
 declare const MorpheusTasksConfigSchema: z.ZodObject<{
     storage_path: z.ZodOptional<z.ZodString>;
     task_list_id: z.ZodOptional<z.ZodString>;
-    claude_code_compat: z.ZodDefault<z.ZodBoolean>;
     scope: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
         project: "project";
         global: "global";
@@ -12,7 +11,6 @@ export declare const MorpheusConfigSchema: z.ZodObject<{
     tasks: z.ZodOptional<z.ZodObject<{
         storage_path: z.ZodOptional<z.ZodString>;
         task_list_id: z.ZodOptional<z.ZodString>;
-        claude_code_compat: z.ZodDefault<z.ZodBoolean>;
         scope: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
             project: "project";
             global: "global";

package/dist/config/schema/security.d.ts

@@ -12,6 +12,32 @@ declare const EnvFileGuardConfigSchema: z.ZodObject<{
     blocked_patterns: z.ZodDefault<z.ZodArray<z.ZodString>>;
     allowed_paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
+declare const InputSecretGuardModeSchema: z.ZodEnum<{
+    prompt: "prompt";
+    off: "off";
+    block: "block";
+}>;
+declare const InputSecretGuardConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    mode: z.ZodDefault<z.ZodEnum<{
+        prompt: "prompt";
+        off: "off";
+        block: "block";
+    }>>;
+    blocklist_mode: z.ZodDefault<z.ZodEnum<{
+        prompt: "prompt";
+        block: "block";
+    }>>;
+    warnlist_mode: z.ZodDefault<z.ZodEnum<{
+        prompt: "prompt";
+        off: "off";
+    }>>;
+    allowlist_patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    detection: z.ZodOptional<z.ZodObject<{
+        entropy_threshold: z.ZodDefault<z.ZodNumber>;
+        max_scan_bytes: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export declare const SecurityConfigSchema: z.ZodObject<{
     secret_scanning: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -30,8 +56,31 @@ export declare const SecurityConfigSchema: z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         on_package_change: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
+    input_secret_guard: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        mode: z.ZodDefault<z.ZodEnum<{
+            prompt: "prompt";
+            off: "off";
+            block: "block";
+        }>>;
+        blocklist_mode: z.ZodDefault<z.ZodEnum<{
+            prompt: "prompt";
+            block: "block";
+        }>>;
+        warnlist_mode: z.ZodDefault<z.ZodEnum<{
+            prompt: "prompt";
+            off: "off";
+        }>>;
+        allowlist_patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        detection: z.ZodOptional<z.ZodObject<{
+            entropy_threshold: z.ZodDefault<z.ZodNumber>;
+            max_scan_bytes: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type SecurityConfig = z.infer<typeof SecurityConfigSchema>;
 export type SecretScanningConfig = z.infer<typeof SecretScanningConfigSchema>;
 export type EnvFileGuardConfig = z.infer<typeof EnvFileGuardConfigSchema>;
+export type InputSecretGuardConfig = z.infer<typeof InputSecretGuardConfigSchema>;
+export type InputSecretGuardMode = z.infer<typeof InputSecretGuardModeSchema>;
 export {};

package/dist/config/schema.d.ts

@@ -9,6 +9,7 @@ export * from "./schema/browser-automation";
 export * from "./schema/categories";
 export * from "./schema/commands";
 export * from "./schema/comment-checker";
+export * from "./schema/context-mode";
 export * from "./schema/dcp";
 export * from "./schema/evolution";
 export * from "./schema/experimental";

package/dist/create-hooks.d.ts

@@ -26,6 +26,7 @@ export declare function createHooks(args: {
     planPersister: ReturnType<typeof import("./hooks").createPlanPersister> | null;
     evolutionCompressor: ReturnType<typeof import("./hooks").createEvolutionCompressorHook> | null;
     evolutionHitl: ReturnType<typeof import("./hooks").createEvolutionHitlHook> | null;
+    inputSecretGuard: ReturnType<typeof import("./hooks").createInputSecretGuardHook> | null;
     keywordDetector: ReturnType<typeof import("./hooks").createKeywordDetectorHook> | null;
     contextInjectorMessagesTransform: ReturnType<typeof import("./features/context-injector").createContextInjectorMessagesTransformHook>;
     envContextInjector: ReturnType<typeof import("./hooks").createEnvContextInjectorHook> | null;
@@ -35,7 +36,6 @@ export declare function createHooks(args: {
     commentChecker: ReturnType<typeof import("./hooks").createCommentCheckerHooks> | null;
     toolOutputTruncator: ReturnType<typeof import("./hooks").createToolOutputTruncatorHook> | null;
     directoryAgentsInjector: ReturnType<typeof import("./hooks").createDirectoryAgentsInjectorHook> | null;
-    directoryReadmeInjector: ReturnType<typeof import("./hooks").createDirectoryReadmeInjectorHook> | null;
     emptyTaskResponseDetector: ReturnType<typeof import("./hooks").createEmptyTaskResponseDetectorHook> | null;
     rulesInjector: ReturnType<typeof import("./hooks").createRulesInjectorHook> | null;
     tasksTodowriteDisabler: ReturnType<typeof import("./hooks").createTasksTodowriteDisablerHook> | null;
@@ -45,6 +45,7 @@ export declare function createHooks(args: {
     envFileWriteGuard: ReturnType<typeof import("./hooks").createEnvFileWriteGuardHook> | null;
     jsonErrorRecovery: ReturnType<typeof import("./hooks").createJsonErrorRecoveryHook> | null;
     bashFileReadGuard: ReturnType<typeof import("./hooks").createBashFileReadGuardHook> | null;
+    contextModeEnforcer: ReturnType<typeof import("./hooks").createContextModeEnforcerHook> | null;
     readImageResizer: ReturnType<typeof import("./hooks").createReadImageResizerHook> | null;
     webfetchRedirectGuard: ReturnType<typeof import("./hooks").createWebFetchRedirectGuardHook> | null;
     hashlineEditDiffEnhancer: ReturnType<typeof import("./hooks").createHashlineEditDiffEnhancerHook> | null;
@@ -57,7 +58,7 @@ export declare function createHooks(args: {
     sessionRecovery: ReturnType<typeof import("./hooks").createSessionRecoveryHook> | null;
     sessionNotification: ReturnType<typeof import("./hooks").createSessionNotification> | null;
     thinkMode: ReturnType<typeof import("./hooks").createThinkModeHook> | null;
-    anthropicContextWindowLimitRecovery: ReturnType<typeof import("./hooks").createAnthropicContextWindowLimitRecoveryHook> | null;
+    contextWindowLimitRecovery: ReturnType<typeof import("./hooks").createContextWindowLimitRecoveryHook> | null;
     autoUpdateChecker: ReturnType<typeof import("./hooks").createAutoUpdateCheckerHook> | null;
     agentUsageReminder: ReturnType<typeof import("./hooks").createAgentUsageReminderHook> | null;
     nonInteractiveEnv: ReturnType<typeof import("./hooks").createNonInteractiveEnvHook> | null;
@@ -68,10 +69,8 @@ export declare function createHooks(args: {
     startWork: ReturnType<typeof import("./hooks").createStartWorkHook> | null;
     oracleMdOnly: ReturnType<typeof import("./hooks").createOracleMdOnlyHook> | null;
     mouseNotepad: ReturnType<typeof import("./hooks").createMouseNotepadHook> | null;
-    questionLabelTruncator: ReturnType<typeof import("./hooks").createQuestionLabelTruncatorHook>;
     taskResumeInfo: ReturnType<typeof import("./hooks").createTaskResumeInfoHook>;
     anthropicEffort: ReturnType<typeof import("./hooks/anthropic-effort").createAnthropicEffortHook> | null;
     runtimeFallback: ReturnType<typeof import("./hooks").createRuntimeFallbackHook> | null;
     rtkBashRewriter: ReturnType<typeof import("./hooks").createRtkBashRewriterHook> | null;
-    mcpStartupNotification: ReturnType<typeof import("./hooks").createMcpStartupNotificationHook> | null;
 };

package/dist/hooks/context-mode-enforcer/constants.d.ts

@@ -0,0 +1,6 @@
+export declare const HOOK_NAME = "context-mode-enforcer";
+export declare const WARN_MESSAGE_READ = "Use ctx_search / ctx_batch_execute / ctx_execute for analysis \u2014 raw read/grep/glob bypasses FTS5 sandbox and pollutes context. Use Read only with hashline IDs for Edit.";
+export declare const BLOCK_MESSAGE_GREP_GLOB = "Blocked: raw grep/glob is forbidden when context-mode is enforced. Use ctx_search (indexed) \u2192 grep/glob fallback only when ctx_* unavailable, or ctx_batch_execute / ctx_execute for multi-file analysis.";
+export declare const WARN_MESSAGE_BASH_READ = "Use ctx_* / Read tool instead of `cat`/`head`/`tail`/`grep` via bash for analysis. Raw bash file reads bypass sandbox.";
+export declare const DEFAULT_BLOCKED_TOOLS: readonly ["grep", "glob"];
+export declare const WARN_ONLY_TOOLS: readonly ["read"];

package/dist/hooks/context-mode-enforcer/hook.d.ts

@@ -0,0 +1,3 @@
+import type { Hooks } from "@opencode-ai/plugin";
+import type { MatrixxConfig } from "../../config";
+export declare function createContextModeEnforcerHook(pluginConfig: MatrixxConfig): Hooks;

package/dist/hooks/context-mode-enforcer/index.d.ts

@@ -0,0 +1 @@
+export { createContextModeEnforcerHook } from "./hook";

package/dist/hooks/context-window-limit-recovery/index.d.ts

@@ -0,0 +1,8 @@
+export { executeCompact, getLastAssistant } from "./executor";
+export * from "./message-builder";
+export { parseAnthropicTokenLimitError, parseTokenLimitError } from "./parser";
+export type { AnthropicContextWindowLimitRecoveryOptions, ContextWindowLimitRecoveryOptions } from "./recovery-hook";
+export { createAnthropicContextWindowLimitRecoveryHook, createContextWindowLimitRecoveryHook } from "./recovery-hook";
+export * from "./recovery-strategy";
+export * from "./state";
+export type { AutoCompactState, ParsedTokenLimitError, TruncateState } from "./types";

package/dist/hooks/context-window-limit-recovery/parser-patterns.d.ts

@@ -0,0 +1,11 @@
+export declare const TOKEN_LIMIT_PATTERNS: RegExp[];
+export declare const TOKEN_LIMIT_KEYWORDS: string[];
+export declare const THINKING_BLOCK_ERROR_PATTERNS: RegExp[];
+export declare const MESSAGE_INDEX_PATTERN: RegExp;
+export declare function extractTokensFromMessage(message: string): {
+    current: number;
+    max: number;
+} | null;
+export declare function extractMessageIndex(text: string): number | undefined;
+export declare function isThinkingBlockError(text: string): boolean;
+export declare function isTokenLimitError(text: string): boolean;

package/dist/hooks/context-window-limit-recovery/parser.d.ts

@@ -0,0 +1,15 @@
+import type { ParsedTokenLimitError } from "./types";
+export { extractMessageIndex, extractTokensFromMessage, isThinkingBlockError, isTokenLimitError, MESSAGE_INDEX_PATTERN, THINKING_BLOCK_ERROR_PATTERNS, TOKEN_LIMIT_KEYWORDS, TOKEN_LIMIT_PATTERNS } from "./parser-patterns";
+export interface GenericErrorData {
+    type: "error";
+    error: {
+        type: string;
+        message: string;
+    };
+    request_id?: string;
+}
+/** @deprecated use GenericErrorData */
+export type AnthropicErrorData = GenericErrorData;
+export declare function parseTokenLimitError(err: unknown): ParsedTokenLimitError | null;
+/** @deprecated use parseTokenLimitError */
+export declare const parseAnthropicTokenLimitError: typeof parseTokenLimitError;

package/dist/hooks/{anthropic-context-window-limit-recovery → context-window-limit-recovery}/recovery-hook.d.ts

@@ -11,3 +11,5 @@ export declare function createAnthropicContextWindowLimitRecoveryHook(ctx: Plugi
         };
     }) => Promise<void>;
 };
+export type ContextWindowLimitRecoveryOptions = AnthropicContextWindowLimitRecoveryOptions;
+export declare const createContextWindowLimitRecoveryHook: typeof createAnthropicContextWindowLimitRecoveryHook;

package/dist/hooks/context-window-limit-recovery/storage.d.ts

@@ -0,0 +1,3 @@
+export { truncateUntilTargetTokens } from "./target-token-truncation";
+export type { AggressiveTruncateResult, ToolResultInfo } from "./tool-part-types";
+export { countTruncatedResults, countTruncatedResultsFromSDK, findLargestToolResult, findToolResultsBySize, findToolResultsBySizeFromSDK, getTotalToolOutputSize, getTotalToolOutputSizeFromSDK, TRUNCATION_MESSAGE, truncateToolResult, truncateToolResultAsync, } from "./tool-result-store";